Please Help, I'm Desperate !

[PersecutedRichard]

TL,DR:  Infected by clicking a link on Twitch. Now I have Internet stalkers that can see my screen, hear my microphone, and use the cameras on both my laptop AND my phone! They've been harassing, threatening, and attempting to extort me since December. Have even temporarily disconnected ISP service, now using only the (infected) phone data until this is fixed.

 

  I don't know why I didn't realize sooner that AV programs would have help forums, I blame my anxiety over this.
  I was infected from a link on Twitch's website I used to make a donation to u/Gavrilka, a streamer there.  On Christmas.  Immediately the hackers started trying to indicate subtly to me that they were able to see everything I did on screen. I wouldn't realize until they then proved they could also hear everything I said as well, and I was able to put it all together. They have access to my emails, texts, and know everywhere I show up online.  They've been reading my emails, my texts, and listening in on counselling sessions with my therapist, then repeating (read as: lying about) all that information to streamers or in chat.
  I immediately reformatted every computer in the house, and began running subscription Avast, subscription Malwarebytes, and subscription ExpressVPN.  It didn't stop.  I then reformatted again using external thumb-drives, and reinstalled the AV, AM, and VPN.  Still there, immediately.  Before I even get done installing the AV, AM, and VPN and updating Windows, there they are.  I've reformatted now several times and gone through 3 routers. I have now closed my ISP account because some random "Hidden Network" had begun broadcasting from their routers. I don't know what it was or how it was involved, but  I had just prior had an entire text conversation with first my Brother then my Mother  on my phone (also with Avast and Malwarebytes installed) before realizing I had manually turned off both wi-fi and cellular service on the phone. How was I texting then?!?  My phone will show programs have been denied access to my microphone (on phone) and yet Malwarebytes privacy check-up will show they are still accessing it. I took a bunch of pictures to document the incident and they were erased from my phone.  On my laptop my ASUS software has repeatedly just quit working, and last clean Windows Install they didn't even install on the system.  Avast clean-up can find registry errors every few minutes even if the laptop has sat idle during that time. (Have not used since last Windows Installation).  Obviously, I've run several full scans of my drives, including Avast boot-up scans and made an Avast recovery thumb-drive which I've also used.  In all this time Avast has only found 1 infection, in a settings file for Firefox.  Quarantined then deleted it.  MalwareBytes Quarantines a couple PuPs, but from gamefiles from Steam(?). Nothing has been found during scans since.  Yet everywhere I go, several of them (or at least several accounts) show up to mock, harass, and threaten me.
   They've threatened my life, the lives of my mother and my cat. I'm desperate. They claim to be law enforcement, but clearly aren't.  My best guess is these are the guys you read about "Sextorting" people online (they threatened to release a video of me masturbating) They've tried demanding first $200,000 then $80,000 to go away. I've gone to cops, I've even spoken to the FBI.  PLEASE help me get rid of this infection. (FRST, Addition, and MBscanlogs attached per request)

 

Thank You in advance for ANY help you can provide.

 

FRST.txt Addition.txt MBScanLog.txt

Edited June 13, 2022 by AdvancedSetup
Corrected font issue

[AdvancedSetup]

The logs are not showing an immediately obvious infection @PersecutedRichard

Please temporarily disable the real time protection of Avast and run the following scanner.

 

 

Microsoft Safety Scanner

Please make sure you Exit out of any other program you might have open so that the sole task is to run the following scan.   
That goes especially for web browsers, make sure all are fully exited out of and messenger programs are exited and closed as well
 

STEP 1

Please set File Explorer to SHOW ALL folders, all files, including hidden ones.  Use OPTION ONE or TWO of this article

https://www.tenforums.com/tutorials/7078-turn-off-show-all-folders-windows-10-navigation-pane.html

STEP 2

I suggest a new scan for viruses & other malware. This may take several hours, depending on the number of files on the system and the speed of the computer.

The Microsoft Safety Scanner is a free Microsoft stand-alone virus scanner that can be used to scan for & remove malware or potentially unwanted software from a system. 

The download links & the how-to-run-the tool are at this link at Microsoft 

https://docs.microsoft.com/en-us/windows/security/threat-protection/intelligence/safety-scanner-download

 

Look on the Scan Options & select the FULL scan.

Then start the scan. Have lots of patience. It may take several hours.

• Once you see it has started, take a long long break;  walk away.  Do not pay credence if you see some intermediate early flash messages on the screen display.  The only things that count are the End result at the end of the run.
• The scan will take several hours.  Leave it alone. It will remove any other remaining threats as it goes along.  Take a very long break, do your normal personal errands .....just do not use the computer during this scan.

This is likely to run for many hours as previously mentioned  ( depending on the number of files on your machine & the speed of the hardware.)

The log is named MSERT.log  and the log will be at C:\Windows\debug\msert.log

Please attach that log with your next reply.

Thank you

 

[PersecutedRichard]

Thank you for your help. This is my second attempt to reply here, as it kept telling me earlier it thought I was spam? The MSRT found only one virus, something about reducing Windows Defender defenses, so I assume just something as a prelude to other attacks. Is there any way of knowing how the virus got there so I don't make the same mistake or if it somehow survived my reformat? My phone is my gateway to the internet, so I'm hoping we can address that as well. I didn't see any instructions on how to scan / add logs for android phones.  I had to rescan after my earlier attempt to respond, so I'm afraid this MSRT log doesn't list the virus :o(

msert.log

[AdvancedSetup]

Please run the following and I'll check back on you again later today after I get some rest

 

Please run the following steps and post back the logs as an attachment when ready.
Temporarily disable your antivirus or other security software first. Make sure to turn it back on once the scans are completed.
Temporarily disable Microsoft SmartScreen to download software below if needed. Make sure to turn it back on once the scans are completed.
If you still have trouble downloading the software please click on Reveal Hidden Contents below for examples of how to allow the download.
 

Spoiler

 

 

 

 

Spoiler

When downloading with some browsers you may see a different style of screens that may block FRST from downloading. The program is safe and used hundreds of times a week by many users.

Example of Microsoft Edge blocking the download

 

STEP 01

• If you already have Malwarebytes installed then open Malwarebytes and click on the Scan button. It will automatically check for updates and run a Threat Scan.
• If you don't have Malwarebytes installed yet please download it from here and install it.
• Once installed then open Malwarebytes and select Scan and let it run.
• Once the scan is completed make sure you have it quarantine any detections it finds.
• If no detections were found click on the Save results drop-down, then the Export to TXT  button, and save the file as a Text file to your desktop or other location you can find and attach that log on your next reply.
• If there were detections then once the quarantine has completed click on the View report button, Then click the Export drop-down, then the Export to TXT  button, and save the file as a Text file to your desktop or other location you can find and attach that log on your next reply.
• If the computer restarted to quarantine you can access the logs from the Detection History, then the History tab. Highlight the most recent scan and double-click to open it. Then click the Export drop-down, then the Export to TXT  button, and save the file as a Text file to your desktop or other location you can find and attach that log on your next reply.
• If Malwarebytes won't run then please skip to the next step and let me know in your next reply that the scanner would not run.

STEP 02

Please download AdwCleaner by Malwarebytes and save the file to your Desktop.

• Double-click to run the program
• Accept the End User License Agreement.
• Wait until the database is updated.
• Click Scan Now.
• When finished, if items are found please click Quarantine.
• Your PC should reboot now if any items were found.
• After reboot, a log file will be opened. Attach or Copy its content into your next reply.

RESTART THE COMPUTER Before running Step 3

STEP 03
Please download the Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit

• Double-click to run it. When the tool opens, click Yes to disclaimer.
• Press the Scan button.
• It will make a log (FRST.txt) in the same directory the tool is run. Please attach it to your reply.
• The first time the tool is run, it also makes another log (Addition.txt). If you've, run the tool before you need to place a check mark here each time
• Please attach the Additions.txt log to your reply as well.
• On your next reply, you should be attaching frst.txt and additions.txt to your post, every time.

 

Thanks

[PersecutedRichard]

Get your sleep my friend, and take your time. I'd rather be thorough than quick.  I've been facing this alone for 6 months, you're a scholar and a gentleman.  

Malwarebytes Quarantines a file from windowsapps, a hard folder to get access to.  It's the second one from that folder with "microsoft teams" in the file name that it has quarantined this Clean Windows Install... even though I deleted microsoft teams after reinstalling windows. Files requested attached.

MBScanLog2.txt AdwCleaner2.txt FRST.txt Addition.txt

[PersecutedRichard]

Sorry, not to double-post but I can't get this out of my head. The reason I ran that MSERT twice was that it showed 2 infected files but only reported 1 infection. In the two times I've run it since, it has shown after 5 minutes that there are "2 infected files" but no infection reported. Screenshots attached.

 

Is this normal?

[AdvancedSetup]

It is normal for the Microsoft Safety Scanner to show detections during the scan process. It is scanning for basically all bread crumbs or traces of files and registry entries that "might" be or have been part of some infection or previous infection.

That DOES NOT mean the computer is infected. Once the scan has been completed it uploads the log to their Cloud service which then uses Artificial Intelligence to determine if in fact any of the traces are an infection or not.

Then it writes into the log on your computer what it found.

 

 

[AdvancedSetup]

Let's have you temporarily uninstall the Avast antivirus software. Windows 10 and 11 already has Windows Defender antivirus builtin that is on par with Avast

Please go to Control Panel, Programs, Programs and Features and uninstall the following

• Avast Driver Updater
• Avast Premium Security
• Avast Secure Browser

 

Then restart the computer and run the Farbar program again and get me new logs

• FRST.txt
• Addition.txt

 

Thanks

 

[PersecutedRichard]

  Good to know that that behavior is normal for Microsoft Safety Scanner, thank you.

To follow your instructions I had to download and install firefox, as I've had a bad history with Edge.  As requested, Avast has been removed. I'm starting to feel it's not the flag-ship it used to be in antivirus programs? Is separate AV even necessary with subscription MalWareBytes installed? If yes, what program, in your personal opinion, would be optimal to run with Malwarebytes? 

Requested logs attached.  Again, thank you for all your help!

FRST.txt Addition.txt

[AdvancedSetup]

Anti-Virus Replacement

Is Malwarebytes 4.0 Premium an anti-virus replacement?

With Malwarebytes 4.0 we are releasing brand new detection technology as part of our Anti-Malware protection. Malwarebytes 4.0 goes beyond traditional AV solutions by applying multiple layers of protection and detection, including proactive ransomware technology, malicious website protection and anti-exploit capabilities. These features combine to deliver the holistic defense across multiple attack vectors necessary to protect users in today’s evolving threat landscape and are backed by Malwarebytes’ powerful linking technology, renowned for its ability to remove all traces of malware from an infected machine.

Since Malwarebytes 4.0 Premium is an anti-virus replacement, will it register itself in Windows Security Center in order for Windows to recognize it as security software?

With any new install Malwarebytes 4.0’s new default behavior is to register in Windows Defender Security Center (also known as Windows Security Center, Windows Action Center) as a primary line of defense. Due to Microsoft’s implementation of Windows Defender Security Center, this means that Windows Defender will disable itself as a result (depending on your operating system). Though we do not prevent you from running traditional anti-virus with Malwarebytes, we recommend that you keep Malwarebytes registered as your primary security to get the most comprehensive protection against threats. 

If you are upgrading from Malwarebytes 3.x, then the behavior is a little different. Your current Windows Security Center registration information for Malwarebytes 3.x will carry over. For example, if you have Malwarebytes 3.x registered in Windows Security Center, then that is what you will see with 4.0. If instead, Malwarebytes 3.x is not registered in Windows Security Center, then it will not register on upgrade to Malwarebytes 4.x and will instead remain in compatibility mode unless you change this in Malwarebytes 4.0’s Settings.

 

Malwarebytes 4 FAQ
https://forums.malwarebytes.com/topic/253972-malwarebytes-4-faqs/#comment-1346719

 

 

[AdvancedSetup]

Generally speaking, many people run a paid version of Malwarebytes alongside the built-in Windows Defender. That way you get the best of both worlds.

 

Let me have you run the following fix, then once that has completed we'll run another scanner, then we'll look at installing the drivers for your computer as there appears to be quite a few missing.

Post back the FIXLOG.txt file when done

 

Please download the attached fixlist.txt file and save it to the Desktop or location where you ran FRST from.
NOTE. It's important that both files, FRST or FRST64, and fixlist.txt are in the same location or the fix will not work.

Please make sure you disable any real-time antivirus or security software before running this script. Once completed, make sure you re-enable it.

NOTICE: This script was written specifically for this user, for use on this particular machine. Running this on another machine may cause damage to your operating system that cannot be undone.

Run FRST or FRST64 and press the Fix button just once and wait.
If the tool needs a restart please make sure you let the system restart normally and let the tool complete its run after restart.
The tool will make a log on the Desktop (Fixlog.txt) or wherever you ran FRST from. Please attach or post it to your next reply.

Note: If the tool warned you about an outdated version please download and run the updated version.

NOTE-1:  This fix will run a scan to check that all Microsoft operating system files are valid and not corrupt and attempt to correct any invalid files. It will also run a disk check on the restart to ensure disk integrity. Depending on the speed of your computer this fix may take 30 minutes or more.

NOTE-2: As part of this fix all temporary files will be removed. If you have any open web pages that have not been bookmarked please make sure you bookmark them now as all open applications will be automatically closed. Also, make sure you know the passwords for all websites as cookies will also be removed. The use of an external password manager is highly recommended instead of using your browser to store passwords.

NOTE-3: As part of this fix it will also reset the network to default settings including the firewall. If you have custom firewall rules you need to save please export or save them first before running this fix.

The following directories are emptied:

• Windows Temp
• Users Temp folders
• Edge, IE, FF, Chrome, and Opera caches, HTML5 storages, Cookies and History
• Recently opened files cache
• Flash Player cache
• Java cache
• Steam HTML cache
• Explorer thumbnail and icon cache
• BITS transfer queue (qmgr*.dat files)
• Recycle Bin

Important: items are permanently deleted. They are not moved to quarantine. If you have any questions or concerns please ask before running this fix.

The system will be rebooted after the fix has run.

fixlist.txt

Thanks

 

[PersecutedRichard]

  Thank you for the information on AV, and for the willingness to help me with those drivers. I was a little bummed Avast's Driver Updater didn't handle them, but I don't know what those devices are and they haven't appeared to hamper system performance so I just let it slide (a couple have scary names anyways... "data acquisition and signal processing controller"?? Not really something you wanna see while people are telling you what you said 5 minutes ago and how long you were in the bathroom that morning... publicly in social media chatrooms!).  I'll be sure to copy the instructions for obtaining those drivers to thumbdrive for future Windows Re-installs if necessary though!

  As requested here is the fixlog. I look forward to whichever scan you plan to run and hope that I get a clean bill of health!  I am a little concerned that I am connecting my PC to the internet through an infected phone still, is it safe to continue doing so?  IOS can't really cross-contaminate Windows right? They had to have delivered whatever is allowing them microphone and camera access on my phone separately somehow?

  I hadn't really planned ahead for this moment, so my ISP is currently shut off...

Fixlog.txt

[PersecutedRichard]

... *Android can't really cross-contaminate Windows ... (right?)

[AdvancedSetup]

They can cause issues. In general, they're different but there are ways to attack each other

 

Please open an elevated admin command prompt and copy-paste the following into the window and then press the Enter key.
It should popup to remove a leftover element of Avast Update Helper

 

MsiExec.exe /I{19C3AB22-3718-4E4D-B203-242F5001565B}   

 

Let me know if that works or if you get an error

 

[AdvancedSetup]

Please right-click over the Malwarebytes tray icon and Exit out of the program.

Then run the following and post back the log

 

SecurityCheck by glax24              

I would like you to run a tool named SecurityCheck to inquire about the current security update status of some applications.

• Download SecurityCheck by glax24: https://tools.safezone.cc/glax24/SecurityCheck/SecurityCheck.exe
• If Microsoft SmartScreen blocks the download, click through to save the file
• This tool is safe.   Smartscreen is overly sensitive.
• If SmartScreen blocks the file from running click on More info and Run anyway
• Right-click  with your mouse on the Securitycheck.exe  and select "Run as administrator"  and reply YES to allow to run & go forward
• Wait for the scan to finish. It will open a text file named SecurityCheck.txt Close the file.  Attach it with your next reply.
• You can find this file in a folder called SecurityCheck, C:\SecurityCheck\SecurityCheck.txt

 

 

Thank you

 

 

[PersecutedRichard]

Command worked, Please see attached requested file.

SecurityCheck.txt

[AdvancedSetup]

Great, that all looks good.

So, if you're using the paid version of Malwarebytes and you want to use Windows Defender as well then open Malwarebytes and go to setting and make sure it's set to the following

Turn off "Always register Malwarebytes in the Windows Security Center"

 

 

This will allow both Malwarebytes and Windows Defender to both run at the same time.

 

Normally exclusions are not needed, but you can add them just in case to make sure there are no conflicts

Malwarebytes for Windows antivirus exclusions list
https://support.malwarebytes.com/hc/en-us/articles/360038522974-Malwarebytes-for-Windows-antivirus-exclusions-list

 

 

[AdvancedSetup]

How is the computer running now?

Are there still any signs of an infection?

 

Is this a Desktop or Laptop computer?

What is the Model number or was this a home built computer?

 

[PersecutedRichard]

  We are working on an ASUS Rogue Strix G512L laptop bought on Amazon about 18 months ago.  The ASUS software, which had begun repeatedly failing after infection occurred, did not even bother to load last time I reformatted.  I can live with that, being as they're in Taiwan and I don't know who it is stalking me and threatening my life and the manufacturers would have the most capability to take control of my system in such a profound and intrusive way.  I'm just mentioning it because you asked about how it's handling now.

  There's also an odd idiosyncrasy it started having after infection occurred.  I have to hit the power button twice for it to register.  Like, I hit the Windows button and the menu comes up, then I hit the power-looking button that brings up the three power options... but it doesn't register the first time. 9 times out of 10 I have to click it twice, even though the start-menu reacts to the first click by the blue line appearing under the search bar disappearing.  This has bothered me because my mind goes to keylogger (hit hidden invisible Window to send recorded keystrokes, perfectly situated above the off button).  To be fair though, it could just as easily be a bug caused by an update to my Windows 11, upgraded from Windows 10 laptop.

  As for the root of the matter, I can't really test if I'm still being followed on my laptop across the Internet because I'm still being followed across the Internet on my phone - last spotted in a chatroom on Youtube (News France 24 live stream) night before last while I checked up on the Ukraine situation from my phone before bed.  Since my phone can still be tracked, using said phone as Internet hub to bring my laptop to any social media sites wouldn't be able to sus out the laptop's integrity. Unfortunately.

  What's next boss?

[AdvancedSetup]

Please run the following

 

Please follow the directions from the following topic and let me know when done.

 

Thank you

 

[AdvancedSetup]

Clean up Google Chrome on your phone too

Send me a Private Message with the DELL Service Tag number of the computer.

 

[PersecutedRichard]

  This brought my Chromebook into play. Did I mention my Chromebook?  I've heard they're pretty hack - resistant, and I rarely had it on the network, but it is the third device on my Malwarebytes plan.  I was going to wait until the laptop and phone were squared away before I brought it up.

  Doing that with the browser / google accounts was a little harder than I thought it would be, but it's done.  I've actually left the sync off for now, even though first thing it does is prompt me to turn it back on every time I log in or open chrome.  Being as I'll be spending as little time as possible online on my Gaming Laptop I then stripped chrome off of it.  I had only installed it out of habit anyways.

  Attempted to send you that service tag but it says I've sent 5 messages today already.  I guess it counted the ones that were blocked as spam?  If you don't have a way to clear that I can make another account just for the job, or we can wait until the reset.

  Again my thanks for all the help.  20 years ago I was an Information Systems Operator Analyst for the military (74B), now I'm less familiar than a teenager when it comes to computing.  It's amazing how far things have changed in two decades! ... though to be honest I was never very good at my job anyways 😆

  The phone and Chromebook both had clean Malwarebytes scans.  I quarantined that result for the laptop, though I'm sure it was a false positive.

MBscanLPT4.txt

[AdvancedSetup]

Let me have you run a different scanner to double-check. I don't expect it to find anything, but no harm in checking.

I would suggest a free scan with the ESET Online Scanner

Go to https://download.eset.com/com/eset/tools/online_scanner/latest/esetonlinescanner.exe

• It will start a download of "esetonlinescanner.exe"
• Save the file to your system, such as the Downloads folder, or else to the Desktop.
• Go to the saved file, and double click it to get it started. 
• When presented with the initial ESET options, click on "Computer Scan".
• Next, when prompted by Windows, allow it to start by clicking Yes 
• When prompted for scan type, Click on Full scan 
• Look at & tick  ( select )   the radio selection "Enable ESET to detect and quarantine potentially unwanted applications"   and click on the Start scan button.
• Have patience.  The entire process may take an hour or more. There is an initial update download.
• There is a progress window display.
• You should ignore all prompts to get the ESET antivirus software program.   ( e.g. their standard program).   You do not need to buy or get or install anything else.
• When the scan is completed, if something was found, it will show a screen with the number of detected items.  If so, click the button marked “View detected results”.
• Click The blue “Save scan log” to save the log.
• If something was removed and you know it is a false finding, you may click on the blue ”Restore cleaned files”  ( in blue, at the bottom).
• Press Continue when all done.  You should click to off the offer for “periodic scanning”.

 

Note: If you do need to do a File Restore from ESET please follow the directions below

[KB2915] Restore files quarantined by the ESET Online Scanner version 3

https://support.eset.com/en/kb2915-restore-files-quarantined-by-the-eset-online-scanner

 

[PersecutedRichard]

 Another false positive but otherwise clean.  That's it for me tonight, feel free to leave me instructions I'll get to right away tomorrow or start fresh in the morning.  Appreciate everything. Have a great night, boss.

ESET.txt

[AdvancedSetup]

Actually an undesirable product by many computer Experts

Please send me a Private Message with the Dell Service Tag number @PersecutedRichard